c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331

Analysis

max time kernel
32s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:35

Target

c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe
Size

455KB
MD5

8f72c70d456e9fa3a5d758c32de19798
SHA1

270653b997c3021ddae396fe591354c7cc0bf5d0
SHA256

c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331
SHA512

64a2d51ace445cbb8f49bbb21ab71d1633ca6c2338931495745eade8e0c2e4c25cf69752122d7182fab4b68f19cc7a55f5d746fec9526bd4709bb453176a56b8
SSDEEP

3072:/ffdqhMewFDu7gr4FJ1nCVagvOfGbEuTjlgzvV+BqW7cQOlOfCicB/e8/tOk4o/X:/fZc6AuTjtB3QZOfCic0kh/X

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1412-54-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1412-61-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 2016	1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2016	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe
2016	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2016	1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	27
PID 1412 wrote to memory of 2016	1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	27
PID 1412 wrote to memory of 2016	1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	27
PID 1412 wrote to memory of 2016	1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	27
PID 1412 wrote to memory of 2016	1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	27
PID 1412 wrote to memory of 2016	1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	27
PID 1412 wrote to memory of 2016	1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	27
PID 1412 wrote to memory of 2016	1412	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	27
PID 2016 wrote to memory of 1200	2016	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	14
PID 2016 wrote to memory of 1200	2016	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	14
PID 2016 wrote to memory of 1200	2016	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	14
PID 2016 wrote to memory of 1200	2016	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	14

memory/1200-63-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1412-54-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1412-61-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2016-58-0x0000000000407A4D-mapping.dmp

Download
memory/2016-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2016-60-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2016-62-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/2016-66-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download